What are the insecure protocols which should be disabled according to PCI DSS standard.

How to check those are disabled in Firewalls and Servers.

  • removed 'ports' as this is irrelevant and meaningless in this context
    – Rory Alsop
    Oct 28 '14 at 9:06

Basically any protocol that does not provide authenticity, integrity and confidentiality. In practice this means FTP should be FTPS or SFTP, telnet should be SSH, POP3 should be POP3S and IMAP should be IMAPS.

It's important to disable all the other protocols and not just provide a secure alternative. The encrypted protocol should provide strong cryptography. Any communication sending sensitive card holder data across the public network should use an encrypted channel such as SSL/TLS or for instance IPSEC.

  • +1 for FTP et.al. If you're using a plaintext service with an insecure, hackable client to access your e-commerce website, you've already lost the battle. Oct 28 '14 at 15:02

This is referencing things such as FTP and telnet, which do not have any encryption at any point but ask for credentials. They basically are saying that you should not use protocols which transmit credentials in cleartext. As per the documentation here: https://www.pcisecuritystandards.org/documents/PCI_DSS_v3.pdf

"Examples of insecure services, protocols, or ports include but are not limited to FTP, telnet, POP3, IMAP, and SNMP v1 and v2."

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.